Error detection/correction and fault detection/recovery – Data processing system error or fault handling – Reliability and availability
Reexamination Certificate
1999-08-19
2003-01-28
Hua, Ly V. (Department: 2131)
Error detection/correction and fault detection/recovery
Data processing system error or fault handling
Reliability and availability
C714S012000
Reexamination Certificate
active
06513131
ABSTRACT:
BACKGROUND OF THE INVENTION
The present invention relates to a self-checking circuit and its method of operation. More particularly, it concerns a self-checking circuit useful for a highly reliable system configuration.
Also, the present invention relates to a method management of a redundant resource, and more particularly concerns an effective use of the redundant resource in a fault tolerant computer system.
Control systems for airplanes, trains, automobiles, and similar means of transportation have been increasingly integrated as advanced control performances are needed to increase energy (fuel) efficiency, operationability, comfortability, and the operation speeds thereof. To run the transportation systems safely, the control systems thereof are forcefully required to be high in reliability and fail-safe performance so that no dangerous output is caused by occurrence of a fault.
To assure the reliability and fail-safe performance of a control system, it is important for the control System to have a capability of detecting the occurrence of a fault, that is, to have a self-checking capability. To accomplish such a self-checking capability, a so-called redundant code is generally used that has a hamming distance of higher than 2 between codes, such as the M-out-of-N code and two-rail logic (1-out-of-2 code) that can be regarded as a kind of M-out-of-N code. The redundant code can perfectly detect a fault as long as it is a single fault. However, it cannot always detect multiple faults. If a self-checking circuit is accomplished in an LSI, a fault may spread over the whole chip. This would be a phenomenon equivalent to the occurrence of multiple faults. Assuming the errors are random, Eq. 1 below gives a probability &eegr; of the occurrence of wrong output signals due to a fault coincident with code points in a specific output code space 0.
&eegr;=
No/Nu
(1)
where No is a number of the code points in the output code space 0 and Nu is a number of the code points. Therefore, it is a problem how to increase Nu to No to increase the detection rate.
There are the following two methods to accomplish a self-checking circuit having such redundant codes as described above.
(1) A method of forming the whole circuit of redundant codes.
(2) A method of replicating function blocks and using a self-checking comparison circuit formed of redundant codes to compare signals output from the function blocks.
The method (1) above is involved in problems that the circuit must be newly designed to make self-checking possible and it is difficult to optimize its operation speed.
On the other hand, the method (2) has the advantage that a conventional processor, memory, and other devices can be used for the function blocks, since only the comparison circuit is required to be newly designed in redundant logic. This can decrease the development cost to a great extent. It also can easily make the operation speed high since advanced semiconductor techniques can be used. The self-checking coverage of the method (2) greatly depends on that of the comparator.
Accordingly, to provide a self-checking comparator, it was proposed to use redundant codes, such as the M-out-of-N code and two-rail logic (1-out-of-2 code), for the logic itself used in the comparison circuit. See, for example, Yoshihiro Toma, “Theory of Fault Tolerant System,” Association of Electronics, Information and Communications, 1990. To realize a self-checking comparator, the RCCO (Reduction Circuit for Checker Output) circuit shown in FIG. 2.5 on page 31 of the publication was connected to a tree structure as shown in FIG. 2.6 on page 32 thereof.
The probability of a fault occurring in the circuits to be compared is low. It is therefore rare that the signals to be compared do not coincide. This means that it is rare that a path to be activated upon detection of an inequality is activated. If there occurs such a mode of fault as fixing, so that the signal output of the path always represents an ‘equality,’ it is feared that the fault is made latent. The comparison circuit, therefore, not only uses the redundant code described above, but also uses a frequency logic, alternating checking method, or similar dynamic logics of alternating signal levels as a signal indicating that the circuit is normal (hereinafter referred to as a signature signal), in place of the binary level logic of 0 and 1. As an example, we can use a method of repositioning a permuter for injecting a simulated fault for testing into the RCCO shown in FIGS. 2. and 5.16 on page 42 in the abovementioned “Theory of Fault Tolerant System.” In this way, an alternating output signal is obtained if the operation is normal. However, the alternating output signal is not obtained, on the other hand, if a fault is caused by a change of a threshold value of a semiconductor device or a fault due to a change of a dc characteristic of the device, such as a failure stacked at 0 or 1. The method also injects a simulated fault periodically to always confirm operation of the error detection feature. These advantages can provide a circuit with an increase in self-checking performance to a great extent.
The above-described prior art has the disadvantage that an adverse effect of crosstalk or shortcircuit between wiring nets in the semiconductor device is likely to occur. If a fault of the semiconductor device causes crosstalk between the wiring nets or shortcircuit between the wiring nets if migration of a wiring material or poor insulation between insulation layers causes a shortcircuit, the wiring net that should not have a signature signal itself may have a signature signal of another wiring net induced thereinto adversely (hereinafter referred to as a counterfeit signature). In general, a fail-safe circuit has a signature signal to indicate that the circuit is normal. The circuit may recognize that it is normal in spite of the counterfeit signature due to crosstalk or a shortcircuit; however, there is the fear that the fail-safe performance of the circuit may be lost.
To prevent such an occurrence of crosstalk and shortcircuit, the prior art has a special design restriction in the wiring spaces. However, this technique requires transistors and wiring lines on the semiconductor substrate having restrictions which are quite different from those of general semiconductors, it cannot have any of the convenience the prior art and automatic designing tools. Most designing works must be performed manually.
Further, computers and transportation controls bear central roles for finance and similar social key industries and parts involved in human life in controlling spaceships and airplanes in recent years. System breakdown or wrong system operation due to a fault of the computers can spread to cause fatal effects in society. In such a trend, high reliability of the computers is increasingly needed.
To make the computers reliable, redundancy is generally employed by providing extra computers and units forming the computer in advance.
On the other hand, the redundant hardware provided to make the computer highly reliable results in a great increase in the cost, dimensions, weight, and power consumption. To enhance the investment effect, or the cost performance, of the fault tolerant computer system, it is necessary to increase the redundant hardware resource effectively with respect to the reliability and processing performance thereof.
There is a method of redundant resource management which uses a redundant hardware resource. That is proposed by Jean-Charles Fabre, et al., “Saturation: reduced idleness for improved fault-tolerance,” Proc. FTCS-18 (The 18th Int'l Symp. on Fault-tolerant Computing), pp. 200-205, 1988.
The proposal by Jean-Charles Fabre, et al., mentioned has MNC (minimum number of copies), or redundant copies, provided in advance to be simultaneously executed for each of a plurality of tasks. If a number of idle nodes (redundant computer modules) is larger than the MNC at the time of arrival of a task execution request, the idle nodes start execution of the task,
Bekki Keisuke
Kanekawa Nobuyasu
Nohmi Makoto
Ohtsuji Shinya
Sato Hiroshi
Antonelli Terry Stout & Kraus LLP
Hitachi , Ltd.
Hua Ly V.
LandOfFree
Logic circuit having error detection function, redundant... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Logic circuit having error detection function, redundant..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Logic circuit having error detection function, redundant... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3039485